---
id: CVE-2025-63401
title: >-
  Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON
  before v.7.6.0 allows a remote attacker to execute arbitrary code via missing
  directives
summary: >-
  Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON
  before v.7.6.0 allows a remote attacker to execute arbitrary code via missing
  directives
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-79
vendor: hcltech
product: dragon
affected:
  - dragon < 7.6.0
patched:
  - dragon 7.6.0
published: '2025-12-03'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-63401'
references:
  - url: >-
      https://excalibur-hcl.my.salesforce.com/sfc/p/#U0000000YO14/a/Pf000003dyQn/x0oUOgfHG6F0wUhpmSMcmXMuwO2GYuSf_duzWPRebao
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00328
epssPercentile: 0.23323
ingestedAt: '2026-07-06T16:44:34.463Z'
---

## Overview

Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing directives

## Affected

- `dragon < 7.6.0`

## Remediation

Upgrade past the affected range:

- `dragon 7.6.0`